FreeScout allows an authenticated user to POST to the save_draft AJAX endpoint, bypassing the APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS setting. This lets non‑assignees or non‑creators create drafts inside conversations that the UI hides, providing a covert channel for data injection and potential information disclosure. The flaw corresponds to CWE‑863, unchecked ownership of resources.

The vulnerability affects versions of FreeScout below 1.8.215, specifically the freescout-help-desk:freescout product. Any deployment running an older release has the risk.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score is not available, so the probability of exploitation is unknown but anonymity of the endpoint may limit exposure. The vulnerability is not listed in CISA KEV. An attacker would need authenticated access and could target the /save_draft endpoint by sending a POST request, exploiting the lack of visibility checks.